SSH Key Fingerprint
Calculate SHA256 and legacy MD5 fingerprints from an OpenSSH public key
Accepts public keys or authorized_keys lines only, never OpenSSH private keys. Fingerprints cover the binary key blob, not the comment.
SHA256, MD5, key type, bits/curve, and comment will appear here.
About this tool
SSH Key Fingerprint reads an OpenSSH public-key or authorized_keys line, validates that the declared key type matches the binary blob, and reports the key family, RSA or DSA bit length or EC curve, comment, blob length, modern SHA256 fingerprint, and legacy colon-separated MD5 fingerprint. It recognizes common RSA, Ed25519, ECDSA, DSA, and security-key type names while rejecting OpenSSH certificates and private-key blocks. Fingerprints cover only the decoded key blob; comments and authorized_keys options are not hashed.
Scenario Recipes
Verify a host or deploy key out of band
Goal: Compare the exact public key before trusting a copied configuration
- Paste the public key received through the deployment channel.
- Record its SHA256 fingerprint and confirm key type and size or curve.
- Compare the fingerprint through a separate trusted channel before adding the normalized line to authorized_keys.
Result: A reviewed public-key identity without handling the private key.
Frequently Asked Questions
Which SSH public-key formats are accepted?
Paste a normal OpenSSH .pub line or an authorized_keys line containing a recognized key type and Base64 blob.
Does the fingerprint include the comment?
No. OpenSSH fingerprints hash the binary key blob; the trailing user@host comment is display metadata.
Why are SHA256 and MD5 both shown?
SHA256 is the modern OpenSSH default, while MD5 helps compare older inventories and console output.
Can it read a private key?
No. Private-key blocks are explicitly rejected and are not needed to calculate a public-key fingerprint.
Are OpenSSH certificates supported?
No. Certificate key types contain additional signed fields and are intentionally rejected by this public-key parser.
Is the key uploaded?
No. Base64 decoding, blob validation, bit inspection, SHA256, and MD5 calculation all run locally.
Keep browsing